CVE-2025-9373: PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the affected WordPress site with Contributor-level access or higher. The attack can be performed remotely and does not require user interaction from the attacker.
Which installations are affected?
All PeproDev Branches Map versions through 3.0.1 are affected. The available information does not state whether a fixed version has been released.
What is the impact after exploitation?
A permitted attacker can store arbitrary script content in a page. That script runs in the browser whenever another user visits the injected page, potentially affecting confidentiality and integrity in the victim's browser context.
How can administrators identify possible exploitation?
Review pages created or edited by Contributor-level and higher accounts for unexpected embedded scripts or suspicious content. Focus on pages associated with the plugin and on changes made by accounts that should not be adding executable web content.